AMTT HiBOS CVE-2025-12253
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint with no interaction needed; impact limited to the application database scope, not full system compromise.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/portal/get_expiredtime.php. This manipulation of the argument uid causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in AMTT Hotel Broadband Operation System (HiBOS) 1.0 exposes hotel network management infrastructure to unauthenticated remote attackers via the uid parameter in /user/portal/get_expiredtime.php. An attacker with network access to the management portal can manipulate the parameter to read, modify, or partially disrupt the underlying database without any credentials. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, and no patch has been released.
Technical ContextAI
HiBOS (Hotel Broadband Operation System) by AMTT Group is a PHP-based hospitality network management platform identified by CPE cpe:2.3:a:amttgroup:hibos:1.0:*:*:*:*:*:*:*. The vulnerability resides in the PHP script /user/portal/get_expiredtime.php, which accepts a uid parameter and passes it to a SQL query without sanitization or parameterization. The root cause class is CWE-74 (Injection), with the specific manifestation being SQL injection (CWE-89 as a child). Because the endpoint appears to belong to the user/portal path - likely a guest-facing or unauthenticated time-check function - no session or credential context is enforced before the parameter is consumed. PHP applications communicating directly with relational databases via string-concatenated queries remain a persistent pattern in legacy hospitality management software.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was unresponsive to disclosure. As a primary compensating control, restrict network access to the /user/portal/get_expiredtime.php endpoint at the perimeter or web server level (e.g., deny rules in nginx/Apache or firewall ACLs), accepting the trade-off that legitimate guest portal functionality may be disrupted. Deploy a Web Application Firewall (WAF) with SQL injection detection rules targeting the uid parameter on requests to this path; note that WAF rules can be bypassed with encoding variations and are not a permanent fix. Operators should also audit the database account used by HiBOS and restrict it to the minimum necessary privileges (e.g., SELECT only where writes are not required), limiting the blast radius of successful injection. System owners should seek a vendor upgrade path or consider migrating to an actively maintained hotel management platform. Monitor VulDB entry https://vuldb.com/?id.329924 for any future patch releases.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today